Preserve the selected Schwab TCP probe in notification revision plans

[Pigbibi]

The selected Schwab revision charles-schwab-quant-service-00781-lel uses a TCP startup probe. The offline notification revision planner currently requires the HTTP probe, so it cannot represent a candidate that preserves this baseline exactly.

Add an explicit schwab-00781-tcp-preserve policy to the existing planner and share structural inventory checks with the existing verifier. The default HTTP policy and verifier CLI behavior remain unchanged. The TCP policy requires the exact selected identity, old image, source declarations and complete probe, then applies the existing before/current/candidate, UID/resourceVersion, traffic/tag and full configuration guards. TCP assurance is explicitly limited to port readiness.

File	Added / removed
scripts/verify_cloud_run_no_traffic_deploy.py	+25 / -6
scripts/build_schwab_notification_revision_plan.py	+69 / -21
tests/test_verify_cloud_run_no_traffic_deploy.py	+36 / -0
tests/test_build_schwab_notification_revision_plan.py	+363 / -0

Validation on head 27628475034a6b78806de156d8a96c297371237d:

• Original 523 cases plus 236 new cases: 759 passed; independent non-author boundary checks: 136 passed. These are 895 distinct final successful cases; reruns are not added again.
• Ruff and diff checks passed. Independent review: PASS_WITH_NOTES, no findings or fix list. An initial reviewer harness identity-comparison failure was corrected only in the independent harness and retained as evidence.
• All original test source prefixes are preserved. The other 256 tracked blobs/modes, all 18 workflows, dependency declarations and business modules are unchanged.

This PR covers the existing offline declaration model only. It does not wire the real publisher or native Cloud Run Service renderer, prove cloud origin or a live resourceVersion conditional update, or verify runtime startup, HTTP health or notification bindings. The planner continues to report deployment_ready=false. Existing deployment startup checks remain unchanged. No production image build, deployment, collector, notification switch or dependency pin change is included.